#2 Colons in attributes

[Ulf Harnhammar]

Currently, kses doesn't handle colons in some attributes
well. In many cases, it thinks that they are a part of a
URL, and starts removing stuff with the whitelisting URL
function. This is bad, for attributes that don't take URLs.

It should be possible to switch on and off the
whitelisting URL protocol thing, to avoid this problem.

[nobunobu]

Logged In: YES
user_id=1270173

For handling "stlye" attributes(it requires colons in it's
value) in kses,
I change a kses_hair() function with following way.

find following lines (3 lines may be found)

$thisval = kses_bad_protocol($match[1], $allowed_protocols);

Replace these lines to following lines.

if (strcasecmp($attrname,'style') != 0) { //hacked by
NobuNobu for handling style attribute;
$thisval = kses_bad_protocol($match[1], $allowed_protocols);
} else {
$thisval =
preg_replace('/(^|;)\s*expression\s*\(/i','\\1XXexpressionXX(',$match[1]);

To avoid executing invalid javascript in style attribute, I
change "expression() " to "XXexpressionXX()".
(because I could not find any regex to determine the end of
"expression()".)

[Nobody/Anonymous]

Logged In: NO

I'm getting "padding:" stripped out from the style tag. Is
there a workaround or fix for this?

[Alpha2zee]

Logged In: YES
user_id=1065794
Originator: NO

See possible solution at http://sourceforge.net/tracker/index.php?func=detail&aid=1752954&group_id=81853&atid=564260